Every CVE Search/ Get API key

CVE-2019-18928

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP...

9.8 CriticalFix available

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.39%Up 1.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
CVE-2019-18928
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
CVE-2019-18928
Updated
2026-11-02
EUVDEUVD-2019-8601 No score

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
EUVD-2019-8601
Updated
2026-11-03
GitHub AdvisoriesGHSA-mpmx-j2j3-253q 9.8

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP...

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
GHSA-mpmx-j2j3-253q
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
CVE-2019-18928
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-18928 9.8

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
DEBIAN-CVE-2019-18928
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVRHSA-2020:4655 7.4

Red Hat Security Advisory: cyrus-imapd security update

Record
RHSA-2020:4655
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-18928 9.8

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

Record
UBUNTU-CVE-2019-18928
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2025-1738170525 No score

Fix CVE(s): CVE-2019-18928

  • SECURITY UPDATE: Privilege escalation via HTTP request interpretation
    • debian/patches/CVE-2019-18928.patch: drop auth credentials if not a backend in a Murder to prevent unauthorized access
    • CVE-2019-18928
Record
CLSA-2025-1738170525
Updated
2026-11-02
OSVopenSUSE-SU-2025:14968-1 No score

cyradm-3.8.4-1.1 on GA media

These are all security issues fixed in the cyradm-3.8.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14968-1
Updated
2026-11-02
OSVUSN-7224-1 No score

cyrus-imapd vulnerabilities

It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication context by a Cyrus IMAP Server when multiple requests arrived over the same connection. An unauthenticated attacker could possibly use this issue to perform a privilege escalation attack. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-18928)

Matthew Horsfall discovered that Cyrus IMAP Server utilized a poor string hashing algorithm that could be abused to control where data was being stored. An attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33582)

Damian Poddebniak discovered that Cyrus IMAP Server could interpret specially crafted commands to exploit a memory issue. An authenticated attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-34055)

Record
USN-7224-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cyrus-admin
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-caldav
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-clients
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-common
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-dev
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-doc
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-imapd
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-murder
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-nntpd
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-pop3d
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
Show 20 moreShow less
Affected packages
PackageAffectedFixed
cyrus-replication
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
libcyrus-imap-perl
TuxCare:Ubuntu:18.04
 before 2.5.10-3ubuntu1.1+tuxcare.els2
2.5.10-3ubuntu1.1+tuxcare.els2
cyrus-imapd
Debian:12
 before 3.0.12-1
3.0.12-1
cyrus-imapd
Debian:13
 before 3.0.12-1
3.0.12-1
cyrus-imapd
Debian:14
 before 3.0.12-1
3.0.12-1
cyrus-imapd
Debian:9
From an advisory covering 2 CVEs
 before 2.5.10-3+deb9u3, plus listed versions
2.5.10-32.5.10-3+deb9u12.5.10-3+deb9u2
2.5.10-3+deb9u3
cyrus-imapd
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-utils
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-vzic
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd-vzic-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:3.0.7-19.el8
0:3.0.7-19.el8
cyrus-imapd
Ubuntu:Pro:18.04:LTS
 before 2.5.10-3ubuntu1.1+esm1, plus listed versions
2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.1
2.5.10-3ubuntu1.1+esm1
cyrus-imapd
Ubuntu:20.04:LTS
 before 3.0.12-1, plus listed versions
3.0.11-13.0.11-1build1
3.0.12-1
cyrus-imapd
Ubuntu:Pro:18.04:LTS
From an advisory covering 3 CVEs
 before 2.5.10-3ubuntu1.1+esm1, plus listed versions
2.5.10-3build12.5.10-3build22.5.10-3ubuntu12.5.10-3ubuntu1.1
2.5.10-3ubuntu1.1+esm1
cyrus-imapd
Ubuntu:Pro:20.04:LTS
From an advisory covering 3 CVEs
 before 3.0.13-5ubuntu0.1~esm1, plus listed versions
3.0.11-13.0.11-1build13.0.12-13.0.12-23.0.12-2ubuntu2
Show 5 moreShow less
3.0.12-2ubuntu33.0.13-2ubuntu13.0.13-3ubuntu13.0.13-4ubuntu13.0.13-5
3.0.13-5ubuntu0.1~esm1
cyrus-imapd
Ubuntu:Pro:22.04:LTS
From an advisory covering 3 CVEs
 before 3.4.3-3ubuntu0.1+esm1, plus listed versions
3.2.6-2build13.4.2-23.4.2-2build13.4.3-23.4.3-33.4.3-3build23.4.3-3ubuntu0.1
3.4.3-3ubuntu0.1+esm1
cyrus-imapd
Ubuntu:Pro:24.04:LTS
From an advisory covering 3 CVEs
 before 3.8.2-1ubuntu0.1~esm1, plus listed versions
3.8.0-53.8.1-13.8.1-1build13.8.1-1build23.8.1-33.8.1-3build33.8.2-1
3.8.2-1ubuntu0.1~esm1
cyrus-imapd
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.8.4-1.1
3.8.4-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-18928 is a critical vulnerability (CVSS 9.8) in Cyrus Imap, published November 15, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.39%, the 84th percentile. Fixed in cyrus-admin 2.5.10-3ubuntu1.1+tuxcare.els2.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open